Freedom251 › Static Application Security Testing Sast
gosec
What gosec is
gosec is a free security checker that scans Go source code for potential security problems. It analyzes the code’s abstract syntax tree and static single assignment representation, using pattern-based rules, SSA analyzers, and taint analysis. Checks cover risks such as injection, path traversal, SSRF, and unsafe deserialization, alongside secure coding, file handling, cryptography and TLS, blocklisted imports, and Go-specific issues. Each finding maps to a Common Weakness Enumeration entry. Users can select or exclude rules, define path-based exclusions, and change global settings such as audit mode. Reports can be generated as text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint, or SARIF. The project documents GitHub Actions use and SARIF uploads to GitHub code scanning; its goanalysis package supports compatible tools such as Bazel nogo. Local installation requires Go 1.25 or newer. Dependencies are loaded using Go modules and resolved automatically in most projects. An optional AI feature can suggest vulnerability fixes via listed providers or custom OpenAI-compatible APIs. Automated detection can produce false positives, and annotations can suppress findings confirmed to be safe.
Who it suits
gosec is for developers and teams checking Go source code for security issues, including those integrating scans into CI. It may suit projects that want configurable rules and multiple report formats.
What it does well
- Checks map findings to CWE entries
- Supports rule selection and path-based exclusions
- Reports include SARIF, JSON, and JUnit XML
- Documented GitHub Actions and GitHub code scanning use
- Apache License 2.0
What to know first
- Local installation requires Go 1.25 or newer
- Automated detection can produce false positives
- AI fix suggestions call an AI API
Limits
The free plan is the gosec open source checker. Local installation requires Go 1.25 or newer, and automated detection can produce false positives.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| gosec | Open source Go security checker · Apache License 2.0 | Free |
As github.com lists them, read 7 Oct 2026. The maker's own page has the final word.
Getting started
- Open the gosec project website on GitHub.
- Install locally with Go 1.25 or newer.
- Use Go modules to load project packages; dependencies resolve automatically in most projects.
- Select or exclude rules and configure path exclusions or global settings.
- Run scans in a documented GitHub Actions workflow and optionally upload SARIF results to GitHub code scanning.
Verdict
gosec offers configurable static security analysis for Go, with several output formats and CI integration options. Teams should review findings because automated detection can flag safe code.
Questions
How much does gosec cost?
The gosec plan is listed at 0.00 USD. The pricing model is free, with a free plan and no free trial.
Which platforms does gosec support?
The listed platforms are Linux, macOS and self-hosted.
What does gosec scan?
It scans Go source code for security problems using AST and SSA representations, pattern rules, SSA analyzers and taint analysis.
Can gosec run in CI/CD and scan pull requests?
Yes. Pull request scans and CI/CD integration are listed, and the project documents GitHub Actions use and SARIF uploads to GitHub code scanning.
Is gosec open source?
Yes. The repository states that gosec is licensed under Apache License 2.0.
Does gosec offer automated fixes?
An optional AI feature can suggest vulnerability fixes through Atlas Cloud, Gemini, Claude, OpenAI or custom OpenAI-compatible APIs.
Facts from gosec's own pages
- AI providers
- Documented providers include Atlas Cloud, Gemini, Claude, OpenAI and arbitrary OpenAI-compatible endpoints such as Azure OpenAI, LocalAI and Ollama. · github.com, 21 Oct 2026
- AI remediation
- An optional autofix mode calls an AI API to suggest fixes for findings. · github.com, 21 Oct 2026
- AI suggestions
- An optional feature can suggest vulnerability fixes by calling an AI API, with providers including Atlas Cloud, Gemini, Claude, OpenAI, and custom OpenAI-compatible APIs. · github.com, 7 Oct 2026
- Bazel integration
- The goanalysis package exposes a golang.org/x/tools/go/analysis Analyzer usable by Bazel nogo. · github.com, 21 Oct 2026
- CI integration
- The project supplies an official GitHub Action for scanning repositories in workflows. · github.com, 21 Oct 2026
- Community
- The Secure Go site links to project guidelines, tools, a community Slack, Stack Overflow, and a blog. · securego.io, 7 Oct 2026
- Configuration
- A JSON configuration file supports global settings such as audit mode and suppression behavior. · github.com, 21 Oct 2026
- CWE mapping
- Each detected issue is mapped to a Common Weakness Enumeration identifier. · github.com, 21 Oct 2026
- Dependencies
- gosec loads packages using Go modules and says dependencies are resolved automatically in most projects. · github.com, 7 Oct 2026
- Detection
- It includes pattern-based rules, SSA analyzers, and taint analysis for risks such as injection, path traversal, SSRF, and unsafe deserialization. · github.com, 7 Oct 2026
- Documentation depth
- Secure Go publishes per-rule guidance pages and links to API reference, Stack Overflow and Slack support channels. · securego.io, 21 Oct 2026
- Exit behavior
- Exit code 0 means no unsuppressed findings or processing errors; code 1 indicates at least one finding or processing error, while -no-fail forces 0. · github.com, 21 Oct 2026
- False positives
- The documentation says automated detection can produce false positives and supports code annotations to suppress verified safe findings. · github.com, 7 Oct 2026
- GitHub code scanning
- SARIF results can be uploaded through GitHub's upload-sarif action for code-scanning findings. · github.com, 21 Oct 2026
- Independent description
- DEV.co describes gosec as a Go static analyzer using pattern matching, control-flow analysis and taint tracking with SARIF support. · dev.co, 21 Oct 2026
- Independent feature summary
- AppSec Santa reports more than 50 CWE-mapped rules covering credentials, injection, cryptography, filesystem, network and memory issues. · appsecsanta.com, 21 Oct 2026
- Independent installation example
- Google's Secure Source Code codelab installs gosec 2.15.0 with the project's install script and runs it with a policy file. · codelabs.developers.google.com, 21 Oct 2026
- Independent praise: deployment
- AppSec Santa praises that the core scanner runs locally through Go modules without a hosted control plane or build server. · appsecsanta.com, 21 Oct 2026
- License
- The repository states that gosec is licensed under Apache License 2.0. · github.com, 7 Oct 2026
- Limit: coverage scope
- AppSec Santa says gosec does not exercise a running application, validate exploitability, model authorization logic or replace dependency scanning and secret rotation. · appsecsanta.com, 21 Oct 2026
- Limit: false positives
- A 2026 NDSS study found gosec had the broadest coverage among evaluated tools but also the highest noise, with 68 findings comprising 31 true positives and 37 false positives (45.59% precision). · ndss-symposium.org, 21 Oct 2026
- Limit: language scope
- AppSec Santa says gosec analyzes Go only, so mixed-language repositories need other scanners for languages, infrastructure and containers. · appsecsanta.com, 21 Oct 2026
- Limit: recurring false positives
- The NDSS study reports that many integer-conversion and weak-cryptography findings were false positives after contextual review. · ndss-symposium.org, 21 Oct 2026
- Local installation
- The documented installation command is go install github.com/securego/gosec/v2/cmd/gosec@latest. · github.com, 21 Oct 2026
Where gosec stands on Freedom251
- Static Application Security Testing Sast#1 of 24
- Static Analysis Tools#2 of 38
- SAST Tools#2 of 26
- Static Application Security Testing Software#2 of 25